An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
References
Configurations
No configuration.
History
21 Aug 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application. |
25 Jun 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-30 03:15
Updated : 2025-08-21 03:15
NVD link : CVE-2025-48757
Mitre link : CVE-2025-48757
CVE.ORG link : CVE-2025-48757
JSON object : View
Products Affected
No product.
CWE
CWE-863
Incorrect Authorization